docs: customer-claim arc — REPORT/CONTEXT, G9 supersede, tester-agreement claim step, day0 D.3/D.4 gate, drill F-4/F-5 RESOLVED

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

documentation/runbooks/day0-install.md

@@ -341,14 +341,24 @@ golden older than 0.86.0? See Part F troubleshooting.)
 
 ### D.3 Customer-visible
 
-- `https://felhom.<customer-domain>` loads the dashboard through the tunnel (cloudflared up
-  in-guest: `pct exec <VMID> -- docker ps --filter name=cloudflared`).
+- `https://felhom.<customer-domain>` answers through the tunnel (cloudflared up in-guest:
+  `pct exec <VMID> -- docker ps --filter name=cloudflared`).
+- **Customer-claim gate (controller ≥ v0.122.0):** a fresh box is CLAIM-GATED, not open — the URL
+  serves the claim page ("A szerver beállítása") and every other route returns the claim page (302)
+  or 401. This is correct and expected (closes the DRILL-day0-vm F-4 exposure). The hub emails a
+  one-time claim code to the customer's registered address on the box's first report; the customer
+  claims by entering the code + choosing their own password. Verify the gate mechanically without
+  claiming: `curl --resolve felhom.<domain>:443:<CF-edge-IP>` on `/` → 302, on `/claim` → 200, on
+  `/api/host-metrics` → 401. Do NOT claim on the operator's behalf — that is the customer's step
+  (onboarding). (An older <0.122 controller has no gate and is open until claimed post-update — the
+  transitional legacy-open red banner shows until the hub delivers a code hash.)
 
 ### D.4 First app deploy (smoke)
 
-In the dashboard, deploy one small catalog app end-to-end (pick something dependency-free). The app
-reaches "running" and its URL answers. This proves the full customer-visible chain: catalog →
-controller → Docker → tunnel → browser.
+Deploy one small dependency-free catalog app end-to-end — **after the customer has claimed the
+dashboard** (the gate blocks deploys pre-claim). The app reaches "running" and its URL answers,
+proving the full chain: catalog → controller → Docker → tunnel → browser. (For an operator-only
+smoke before claim, drive the in-guest Host-header probe instead — the public path is gated.)
 
 ---